Executive brief
The Linux kernel's uprobe (user-space probe) tracing mechanism contained a logic error when checking whether code is running inside an uprobe trampoline. The code was using the wrong memory context during probe unregistration, potentially allowing unsafe memory access or incorrect probe state transitions that could lead to system instability or privilege escalation.
Technical details
The vulnerability is a context confusion bug in arch/x86/kernel/uprobes.c. The __in_uprobe_trampoline() function was using current->mm to look up virtual memory areas during the probe unregistration path, but it was executing in the tracer context rather than the traced process context. This resulted in incorrect VMA lookups and potential access to the wrong memory space. The fix adds an mm_struct pointer argument to __in_uprobe_trampoline() and all related callers (__is_optimized() and in_uprobe_trampoline()) to ensure the correct memory context is used. The vulnerability affects kernel versions with the uprobe optimization feature enabled and requires local access to trigger via uprobe registration/unregistration.
Affected products
- Linux Linux kernel versions containing commit ba2bfc97b462 (uprobes/x86: Add support to optimize uprobes) and prior to fix commit 169328645663bae30e9abad4012d52441e085a71
Timeline
- 2026-08-15: disclosed
- 2026-07-02: patched